opsiom-cli 1.5.0__tar.gz → 1.5.2__tar.gz

{opsiom_cli-1.5.0 → opsiom_cli-1.5.2}/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## 1.5.0
+## 1.5.2
 
 ### Ajouts
 - Sous-commandes `opsiom doctor` (diagnostic), `opsiom paths` (emplacements des fichiers) et `opsiom configure`.

{opsiom_cli-1.5.0 → opsiom_cli-1.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: opsiom-cli
-Version: 1.5.0
+Version: 1.5.2
 Summary: Interface en ligne de commande pour discuter avec Opsiom, l'assistant IA francophone.
 Keywords: chatbot,cli,francophone,ia,opsiom
 Classifier: Environment :: Console

{opsiom_cli-1.5.0 → opsiom_cli-1.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "opsiom-cli"
-version = "1.5.0"
+version = "1.5.2"
 description = "Interface en ligne de commande pour discuter avec Opsiom, l'assistant IA francophone."
 readme = "README.md"
 requires-python = ">=3.9"

{opsiom_cli-1.5.0 → opsiom_cli-1.5.2}/src/opsiom_cli/clients.py

@@ -9,7 +9,9 @@ Les deux clients exposent la même interface :
 
 import html
 import json
+import os
 import re
+import sys
 
 import requests
 
@@ -62,6 +64,38 @@ def error_detail(exc):
     return None
 
 
+# --- Formulaire de connexion -------------------------------------------------
+
+_INPUT_RE = re.compile(r"<input\b[^>]*>", re.IGNORECASE)
+_ATTR_RE = re.compile(r"""([\w-]+)\s*=\s*(?:"([^"]*)"|'([^']*)')""")
+
+
+def parse_login_form(page_html):
+    """Repère dans la page de connexion :
+    - les champs cachés (jeton CSRF, etc.), à renvoyer tels quels ;
+    - le nom du champ pseudo et celui du champ mot de passe.
+    Ne lit jamais de valeur saisie par l'utilisateur."""
+    hidden, user_field, pass_field = {}, None, None
+    for tag in _INPUT_RE.findall(page_html or ""):
+        attrs = {key.lower(): (dq or sq) for key, dq, sq in _ATTR_RE.findall(tag)}
+        name = attrs.get("name")
+        if not name:
+            continue
+        kind = attrs.get("type", "text").lower()
+        if kind == "hidden":
+            hidden[name] = attrs.get("value", "")
+        elif kind == "password":
+            pass_field = pass_field or name
+        elif kind in ("text", "email") and user_field is None:
+            user_field = name
+    return {"hidden": hidden, "username": user_field, "password": pass_field}
+
+
+def _debug(message):
+    if os.environ.get("OPSIOM_DEBUG"):
+        print(f"[debug] {message}", file=sys.stderr)
+
+
 class OpsiomClient:
     """Serveur d'inférence classique : routes /api/*, clé API (X-API-Key)."""
 
@@ -104,8 +138,9 @@ class OpsiomClient:
 
 
 class HFSpaceClient:
-    """Space Hugging Face qui héberge Opsiom. Authentification par compte Octix
-    (formulaire /login, session par cookie). Historique et quota vivent côté Space."""
+    """Space Hugging Face qui héberge Opsiom. Authentification par compte Octix :
+    le CLI se comporte comme un navigateur (page /login, puis formulaire).
+    Historique et quota vivent côté Space."""
 
     backend = "hf"
     tracks_quota = True
@@ -117,7 +152,7 @@ class HFSpaceClient:
         self.username = username
         self.identity = account_identity(self.base_url, username)
         self.conversation_id = None
-        self.session = requests.Session()
+        self.session = requests.Session()  # garde le cookie de session entre les requêtes
         self.session.headers["User-Agent"] = "opsiom-cli"
         if hf_token:  # Space privé
             self.session.headers["Authorization"] = f"Bearer {hf_token}"
@@ -132,30 +167,54 @@ class HFSpaceClient:
 
     def login(self, username, password):
         """Ouvre la session du Space. Renvoie (True, None) ou (False, message)."""
+        # Les caractères de contrôle ne peuvent pas faire partie d'un mot de passe saisi
+        # au clavier ; sous Windows, un Ctrl+V dans getpass les insère pourtant tels quels.
+        removed = len(re.findall(r"[\x00-\x1f\x7f]", password))
+        password = re.sub(r"[\x00-\x1f\x7f]", "", password)
+        _debug(f"pseudo envoyé : {username!r} ; mot de passe : {len(password)} caractère(s)"
+               + (f", {removed} caractère(s) de contrôle supprimé(s)" if removed else ""))
+
+        # 1. Charger la page de connexion : cookie de session + champs du formulaire.
+        try:
+            page = self.session.get(f"{self.base_url}/login", timeout=90)
+        except requests.RequestException as exc:
+            return False, f"Space injoignable ({exc.__class__.__name__})."
+        form = parse_login_form(page.text if page.ok else "")
+        _debug(f"GET /login -> HTTP {page.status_code}, champs cachés : {sorted(form['hidden'])}, "
+               f"champ pseudo : {form['username']!r}, champ mot de passe : {form['password']!r}")
+
+        # 2. Soumettre le formulaire avec les champs cachés (jeton CSRF).
+        data = dict(form["hidden"])
+        data[form["username"] or "username"] = username
+        data[form["password"] or "password"] = password
         try:
-            r = self.session.post(
-                f"{self.base_url}/login",
-                data={"username": username, "password": password},
-                timeout=90,  # un Space endormi met un moment à se réveiller
-                allow_redirects=False,
-            )
+            r = self.session.post(f"{self.base_url}/login", data=data, timeout=90,
+                                  allow_redirects=False)
         except requests.RequestException as exc:
             return False, f"Space injoignable ({exc.__class__.__name__})."
         location = r.headers.get("Location", "")
-        # Succès = redirection hors de /login. Un échec qui redirige vers /login
-        # n'est donc pas pris pour une réussite.
+        _debug(f"POST /login -> HTTP {r.status_code}, Location : {location or '—'}")
+
+        # 3. Interpréter la réponse.
         if r.status_code in (301, 302, 303, 307, 308) and "/login" not in location:
-            self.username = username
-            self.identity = account_identity(self.base_url, username)
-            return True, None
+            return self._accept(username)
         flash = re.search(r'<li class="flash[^"]*">(.*?)</li>', r.text or "", re.S)
         if flash:
             return False, html.unescape(re.sub(r"<[^>]+>", "", flash.group(1))).strip()
+        if r.status_code == 200 and parse_login_form(r.text)["password"] is None:
+            return self._accept(username)  # connecté sans redirection
         if r.status_code in (400, 401, 403):
-            return False, "pseudo ou mot de passe refusé."
+            return False, (f"pseudo ou mot de passe refusé (HTTP {r.status_code}). "
+                           "Si le mot de passe est bon, lancez « OPSIOM_DEBUG=1 opsiom » "
+                           "pour voir ce que demande le formulaire.")
         return False, (f"réponse inattendue (HTTP {r.status_code}). Le Space démarre peut-être : "
                        "réessayez dans une minute.")
 
+    def _accept(self, username):
+        self.username = username
+        self.identity = account_identity(self.base_url, username)
+        return True, None
+
     def health(self):
         r = self.session.get(f"{self.base_url}/status", timeout=30)
         r.raise_for_status()

{opsiom_cli-1.5.0 → opsiom_cli-1.5.2}/tests/test_core.py

@@ -164,3 +164,15 @@ def test_stream_printer_keeps_indentation(capsys):
     assert "\n" + " " * 6 + "def f():" in out
     assert "\n" + " " * 10 + "pass" in out
     assert text == "Voici :\n    def f():\n        pass"
+
+
+def test_parse_login_form_finds_hidden_fields_and_names():
+    from opsiom_cli.clients import parse_login_form
+
+    page = (
+        '<form><input type="hidden" name="csrf_token" value="abc123">'
+        "<input name='pseudo' type='text'>"
+        '<input type="password" name="mdp"></form>'
+    )
+    form = parse_login_form(page)
+    assert form == {"hidden": {"csrf_token": "abc123"}, "username": "pseudo", "password": "mdp"}

opsiom_cli-1.5.2/tests/test_http.py

@@ -0,0 +1,176 @@
+"""Tests de bout en bout des clients contre des faux serveurs HTTP locaux."""
+
+import json
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from urllib.parse import parse_qs
+
+import pytest
+import requests
+
+from opsiom_cli.chat import explain_error
+from opsiom_cli.clients import HFSpaceClient, OpsiomClient
+
+API_KEY = "secret"
+
+
+@pytest.fixture(autouse=True)
+def no_proxy(monkeypatch):
+    monkeypatch.setenv("NO_PROXY", "127.0.0.1,localhost")
+    monkeypatch.setenv("no_proxy", "127.0.0.1,localhost")
+
+
+def _serve(handler):
+    httpd = ThreadingHTTPServer(("127.0.0.1", 0), handler)
+    threading.Thread(target=httpd.serve_forever, daemon=True).start()
+    return httpd
+
+
+# --- Faux serveur Opsiom (API) ----------------------------------------------
+
+class FakeOpsiom(BaseHTTPRequestHandler):
+    def log_message(self, *args):
+        pass
+
+    def _json(self, status, body):
+        data = json.dumps(body).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+
+    def do_GET(self):
+        if self.path == "/api/health":
+            self._json(200, {"status": "ok", "models_loaded": ["m1"], "quota": {"remaining": 490}})
+        elif self.path == "/api/models":
+            self._json(200, {"models": [{"id": "m1", "label": "Modèle 1", "params": "7B"}],
+                             "default": "m1"})
+        else:
+            self._json(404, {"error": "introuvable"})
+
+    def do_POST(self):
+        length = int(self.headers.get("Content-Length", 0))
+        self.rfile.read(length)
+        if self.headers.get("X-API-Key") != API_KEY:
+            self._json(401, {"error": "clé invalide"})
+            return
+        if self.path != "/api/chat/stream":
+            self._json(404, {"error": "introuvable"})
+            return
+        self.send_response(200)
+        self.send_header("Content-Type", "text/event-stream")
+        self.end_headers()
+        events = [{"token": "Bon"}, {"token": "jour"},
+                  {"done": True, "model": "m1", "remaining_quota": 489}]
+        for event in events:
+            self.wfile.write(f"data: {json.dumps(event)}\n\n".encode("utf-8"))
+            self.wfile.flush()
+
+
+@pytest.fixture
+def opsiom_server():
+    httpd = _serve(FakeOpsiom)
+    yield f"http://127.0.0.1:{httpd.server_address[1]}"
+    httpd.shutdown()
+    httpd.server_close()
+
+
+def test_health_models_and_stream(opsiom_server):
+    client = OpsiomClient(opsiom_server, api_key=API_KEY)
+    assert client.health()["status"] == "ok"
+    assert client.list_models()["default"] == "m1"
+    pieces = list(client.chat_stream("Bonjour ?", model="m1"))
+    assert "".join(p for p in pieces if isinstance(p, str)) == "Bonjour"
+    assert pieces[-1]["remaining_quota"] == 489
+
+
+def test_wrong_key_is_explained(opsiom_server):
+    client = OpsiomClient(opsiom_server, api_key="mauvaise")
+    with pytest.raises(requests.HTTPError) as info:
+        list(client.chat_stream("x"))
+    msg, _hint = explain_error(info.value, client)
+    assert "clé API" in msg
+
+
+# --- Faux Space Hugging Face : formulaire avec cookie + jeton CSRF -----------
+
+LOGIN_PAGE = (
+    '<html><body><form method="post" action="/login">'
+    '<input type="hidden" name="csrf_token" value="tok123">'
+    '<input type="text" name="identifiant">'
+    '<input type="password" name="secret">'
+    '<button>Connexion</button></form></body></html>'
+).encode("utf-8")
+
+
+class FakeSpace(BaseHTTPRequestHandler):
+    """Comme un Flask-WTF : le POST n'est accepté qu'avec le cookie de session
+    obtenu sur GET /login et le bon jeton CSRF. Champs : identifiant / secret."""
+
+    def log_message(self, *args):
+        pass
+
+    def _send(self, status, body=b"", headers=()):
+        self.send_response(status)
+        for key, value in headers:
+            self.send_header(key, value)
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self):
+        if self.path == "/login":
+            self._send(200, LOGIN_PAGE, [("Content-Type", "text/html; charset=utf-8"),
+                                         ("Set-Cookie", "session=abc; Path=/")])
+        else:
+            self._send(404)
+
+    def do_POST(self):
+        length = int(self.headers.get("Content-Length", 0))
+        form = parse_qs(self.rfile.read(length).decode("utf-8"))
+        if "session=abc" not in self.headers.get("Cookie", "") or form.get("csrf_token") != ["tok123"]:
+            self._send(400, b"The CSRF token is missing.")
+            return
+        if form.get("identifiant") == ["alice"] and form.get("secret") == ["bon"]:
+            self._send(302, headers=[("Location", "/")])
+        else:
+            page = LOGIN_PAGE.replace(b"<button>", b'<ul><li class="flash error">Mot de passe incorrect</li></ul><button>')
+            self._send(200, page, [("Content-Type", "text/html; charset=utf-8")])
+
+
+@pytest.fixture
+def space_server():
+    httpd = _serve(FakeSpace)
+    yield f"http://127.0.0.1:{httpd.server_address[1]}"
+    httpd.shutdown()
+    httpd.server_close()
+
+
+def test_direct_post_without_page_is_refused(space_server):
+    """Reproduit l'ancien comportement : POST sans passer par /login."""
+    r = requests.post(f"{space_server}/login", data={"identifiant": "alice", "secret": "bon"},
+                      allow_redirects=False)
+    assert r.status_code == 400
+
+
+def test_octix_login_with_csrf_and_custom_field_names(space_server):
+    client = HFSpaceClient(space_server)
+    ok, message = client.login("alice", "bon")
+    assert ok is True and message is None
+    assert client.username == "alice"
+    assert client.identity.startswith("hf-")
+
+
+def test_octix_wrong_password_shows_site_message(space_server):
+    client = HFSpaceClient(space_server)
+    ok, message = client.login("alice", "mauvais")
+    assert ok is False
+    assert "incorrect" in message
+
+
+def test_control_characters_are_removed_from_password(space_server):
+    """Un Ctrl+V sous Windows peut insérer \x16 dans le mot de passe."""
+    client = HFSpaceClient(space_server)
+    ok, _ = client.login("alice", "bon\x16")
+    assert ok is True

opsiom_cli-1.5.0/.env

@@ -1 +0,0 @@
-TOKEN_PYPI=pypi-AgEIcHlwaS5vcmcCJDI3YTY0YTk5LTExZDktNDFlOS04ZGE4LTU1MWFmNDcwZTg1MAACKlszLCJjYzExY2QyYy00ODg4LTRlOTItOTNmYy00NTdhMDhlMWQ5NjQiXQAABiDBNDAJrhWz9Rt11yQPXO1klHHZCcHTEsImiD4G6FOTWA

opsiom_cli-1.5.0/tests/test_http.py

@@ -1,130 +0,0 @@
-"""Tests de bout en bout des clients contre un faux serveur HTTP local."""
-
-import json
-import threading
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-
-import pytest
-import requests
-
-from opsiom_cli.chat import explain_error
-from opsiom_cli.clients import OpsiomClient
-
-API_KEY = "secret"
-
-
-class FakeOpsiom(BaseHTTPRequestHandler):
-    def log_message(self, *args):  # silence les logs du serveur de test
-        pass
-
-    def _json(self, status, body):
-        data = json.dumps(body).encode("utf-8")
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Content-Length", str(len(data)))
-        self.end_headers()
-        self.wfile.write(data)
-
-    def do_GET(self):
-        if self.path == "/api/health":
-            self._json(200, {"status": "ok", "models_loaded": ["m1"],
-                             "quota": {"remaining": 490}})
-        elif self.path == "/api/models":
-            self._json(200, {"models": [{"id": "m1", "label": "Modèle 1", "params": "7B"}],
-                             "default": "m1"})
-        else:
-            self._json(404, {"error": "introuvable"})
-
-    def do_POST(self):
-        length = int(self.headers.get("Content-Length", 0))
-        self.rfile.read(length)
-        if self.headers.get("X-API-Key") != API_KEY:
-            self._json(401, {"error": "clé invalide"})
-            return
-        if self.path != "/api/chat/stream":
-            self._json(404, {"error": "introuvable"})
-            return
-        self.send_response(200)
-        self.send_header("Content-Type", "text/event-stream")
-        self.end_headers()
-        events = [
-            {"token": "Bon"},
-            {"token": "jour"},
-            {"done": True, "model": "m1", "remaining_quota": 489},
-        ]
-        for event in events:
-            self.wfile.write(f"data: {json.dumps(event)}\n\n".encode("utf-8"))
-            self.wfile.flush()
-
-
-@pytest.fixture
-def server(monkeypatch):
-    monkeypatch.setenv("NO_PROXY", "127.0.0.1,localhost")
-    monkeypatch.setenv("no_proxy", "127.0.0.1,localhost")
-    httpd = ThreadingHTTPServer(("127.0.0.1", 0), FakeOpsiom)
-    thread = threading.Thread(target=httpd.serve_forever, daemon=True)
-    thread.start()
-    yield f"http://127.0.0.1:{httpd.server_address[1]}"
-    httpd.shutdown()
-    httpd.server_close()
-
-
-def test_health_models_and_stream(server):
-    client = OpsiomClient(server, api_key=API_KEY)
-    assert client.health()["status"] == "ok"
-    assert client.list_models()["default"] == "m1"
-    pieces = list(client.chat_stream("Bonjour ?", model="m1"))
-    text = "".join(p for p in pieces if isinstance(p, str))
-    assert text == "Bonjour"
-    assert pieces[-1]["remaining_quota"] == 489
-
-
-def test_wrong_key_is_explained(server):
-    client = OpsiomClient(server, api_key="mauvaise")
-    with pytest.raises(requests.HTTPError) as info:
-        list(client.chat_stream("x"))
-    msg, _hint = explain_error(info.value, client)
-    assert "clé API" in msg
-
-
-class FakeSpace(BaseHTTPRequestHandler):
-    """Space Hugging Face minimal : /login redirige vers / si le mot de passe est bon,
-    sinon vers /login (comportement courant d'un formulaire Flask/Gradio)."""
-
-    def log_message(self, *args):
-        pass
-
-    def do_POST(self):
-        length = int(self.headers.get("Content-Length", 0))
-        body = self.rfile.read(length).decode("utf-8")
-        if self.path == "/login" and "password=bon" in body:
-            self.send_response(302)
-            self.send_header("Location", "/")
-        else:
-            self.send_response(302)
-            self.send_header("Location", "/login")
-        self.send_header("Content-Length", "0")
-        self.end_headers()
-
-
-@pytest.fixture
-def space(monkeypatch):
-    monkeypatch.setenv("NO_PROXY", "127.0.0.1,localhost")
-    monkeypatch.setenv("no_proxy", "127.0.0.1,localhost")
-    httpd = ThreadingHTTPServer(("127.0.0.1", 0), FakeSpace)
-    threading.Thread(target=httpd.serve_forever, daemon=True).start()
-    yield f"http://127.0.0.1:{httpd.server_address[1]}"
-    httpd.shutdown()
-    httpd.server_close()
-
-
-def test_octix_login_success_and_failure(space):
-    from opsiom_cli.clients import HFSpaceClient
-
-    client = HFSpaceClient(space, username=None)
-    ok, _ = client.login("alice", "mauvais")
-    assert ok is False  # une redirection vers /login n'est pas une réussite
-    ok, _ = client.login("alice", "bon")
-    assert ok is True
-    assert client.username == "alice"
-    assert client.identity.startswith("hf-")